An improved algorithm to accelerate regular expression evaluation

11 years 5 months ago
An improved algorithm to accelerate regular expression evaluation
Modern network intrusion detection systems need to perform regular expression matching at line rate in order to detect the occurrence of critical patterns in packet payloads. While deterministic finite automata (DFAs) allow this operation to be performed in linear time, they may exhibit prohibitive memory requirements. In [9], Kumar et al. propose Delayed Input DFAs (D2 FAs), which provide a trade-off between the memory requirements of the compressed DFA and the number of states visited for each character processed, which corresponds directly to the memory bandwidth required to evaluate regular expressions. In this paper we introduce a general compression technique that results in at most 2N state traversals when processing a string of length N. In comparison to the D2 FA approach, our technique achieves comparable levels of compression, with lower provable bounds on memory bandwidth (or greater compression for a given bandwidth bound). Moreover, our proposed algorithm has lower compl...
Michela Becchi, Patrick Crowley
Added 12 Aug 2010
Updated 12 Aug 2010
Type Conference
Year 2007
Where ANCS
Authors Michela Becchi, Patrick Crowley
Comments (0)